Routing, WAN and Internet Connectivity

Introduction

Modern organisations depend on networks that connect users, applications, data centres, cloud platforms and external services. A local area network (LAN) may provide high-speed communication within a building, but communication between branches, data centres and Internet services requires routing and wide area networking (WAN). Routing determines where packets should go; WAN technologies provide the underlying connectivity; and Internet access connects an organisation to networks beyond its administrative control.

This chapter examines how routers make forwarding decisions, how routing information is learned and maintained, and how organisations select among leased lines, broadband, VPNs, SD-WAN and other connectivity options. The emphasis is both conceptual and practical: a network professional must understand not only how protocols operate, but also how availability, latency, security, cost and operational complexity affect design decisions.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the purpose and operation of routing and routing tables.
2. Distinguish directly connected, static and dynamically learned routes.
3. Describe path selection using administrative distance, prefix length and metric.
4. Explain major routing protocol concepts, including distance-vector, link-state and path-vector approaches.
5. Compare WAN, leased-line, broadband, VPN, SD-WAN and Internet connectivity options.
6. Select an appropriate connectivity model for a realistic organisational scenario.
7. Identify routing, security, availability and governance risks in WAN designs.

1. Routing Fundamentals

A router is a Layer 3 device that forwards packets between different IP networks. Unlike a switch, which primarily forwards frames within a broadcast domain using MAC addresses, a router examines the destination IP address and selects an appropriate next hop or outgoing interface.

A packet-forwarding decision normally follows these steps:

1. The router receives a frame on an interface.
2. It removes the Layer 2 header and examines the destination IP address.
3. It consults its routing table.
4. It selects the most specific usable route.
5. It decrements the packet's time-to-live (TTL) or hop limit.
6. It forwards the packet through the selected interface, placing it in a new data-link frame.

If no matching route exists, the router may use a default route. If neither a specific route nor a default route exists, the packet is discarded and an Internet Control Message Protocol (ICMP) destination-unreachable message may be generated.

Networks, prefixes and next hops

An IPv4 route is commonly written in prefix notation, such as 192.168.10.0/24. The /24 indicates that 24 bits identify the network portion and the remaining 8 bits identify host addresses. A route can contain:

• Destination prefix: the network being reached.
• Prefix length or subnet mask: the range of addresses covered.
• Next hop: the neighbouring router to which the packet is sent.
• Outgoing interface: the local interface used for forwarding.
• Metric: a protocol-specific measure of route preference.
• Administrative distance: a device-local preference between route sources.
• Route status and age: information used to determine whether the route is valid.

The number of IPv4 addresses represented by a prefix of length p is:

where N is the number of addresses and p is the prefix length. This includes network and broadcast addresses in ordinary IPv4 subnetting, so usable host addresses in a conventional subnet are:

The subtraction applies to conventional IPv4 subnets where the all-zero host address identifies the network and the all-one host address is the broadcast address. Special cases, such as /31 point-to-point links and /32 host routes, require different treatment.

For example, a /26 network contains 2^(32−26) = 64 addresses and normally supports 62 usable host addresses.

2. Routing Tables and Longest-Prefix Matching

A routing table is a collection of routes used by the forwarding process. A simplified table might contain the following entries:

Routing uses longest-prefix matching. This means that the route with the greatest number of matching network bits is selected, regardless of the order in which entries appear in the table. A packet destined for 10.10.20.140 matches /16, /24 and /25, but the /25 route is selected because it is most specific. A packet destined for 10.10.20.60 matches /16 and /24, so the /24 route is selected.

The default route, 0.0.0.0/0, matches every IPv4 destination but is less specific than any route with a longer prefix. It is therefore used only when no more specific route is available.

IPv6 uses the same general principle of longest-prefix matching, although address size, notation and protocol details differ. An IPv6 default route is written as ::/0.

3. Static Routing

A static route is manually configured by an administrator. For example, a router might be configured to send traffic for 10.20.0.0/16 to next hop 192.0.2.10. Static routes do not automatically discover topology changes; they remain in the configuration until changed or withdrawn.

Advantages

• Predictable behaviour and low protocol overhead.
• Simple operation in small or stable networks.
• No routing-protocol messages are required.
• Useful for default routes, stub networks and controlled security paths.
• Can provide a backup path with an appropriately higher preference.

Limitations

• Configuration becomes difficult as the network grows.
• A failed path may remain installed unless tracking or an alternative mechanism is used.
• Manual changes are vulnerable to inconsistency and human error.
• Static routes do not automatically adapt to topology changes.

A floating static route is configured with a lower preference than a primary route. It remains inactive while the primary route is available and becomes eligible when the primary route disappears. Reliability is improved further when the route is tied to object tracking, IP Service Level Agreement (IP SLA), Bidirectional Forwarding Detection (BFD) or an equivalent health-check mechanism.

4. Dynamic Routing

Dynamic routing protocols allow routers to exchange reachability information and calculate routes. They can detect failures, learn new networks and converge on an updated topology. Dynamic routing is particularly valuable where there are multiple paths, frequent changes or many routers.

Dynamic routing has three broad families:

Distance-vector protocols

Distance-vector protocols advertise destinations and a distance or cost through neighbouring routers. Each router generally knows information received from neighbours rather than a complete network map. Classic Routing Information Protocol (RIP) is an example. RIP uses hop count as its metric and has a maximum usable distance of 15 hops; a metric of 16 represents unreachable. This limits its usefulness in modern enterprise networks.

Distance-vector designs can be susceptible to routing loops and slow convergence. Techniques such as split horizon, route poisoning, hold-down timers and triggered updates reduce these risks.

Link-state protocols

Link-state protocols distribute information about links and their states so that routers can construct a topology database. Each router independently runs a shortest-path algorithm, commonly Dijkstra's Shortest Path First (SPF), to calculate routes. Open Shortest Path First (OSPF) and Intermediate System to Intermediate System (IS-IS) are major examples.

Link-state protocols generally converge faster and scale better than simple distance-vector protocols, but they require more memory, processing and design discipline. OSPF supports hierarchical areas, with Area 0 traditionally serving as the backbone area.

Path-vector protocols

Path-vector protocols advertise a destination together with attributes describing the path. Border Gateway Protocol (BGP) is the principal example and is used between autonomous systems on the Internet. BGP can apply policy based on attributes such as AS path length, local preference, origin and multi-exit discriminator.

BGP is not simply a shortest-path protocol. It is a policy-control system that allows an organisation to decide which routes to accept, prefer, advertise or reject. Incorrect BGP filtering can cause outages, route leaks or traffic interception, making configuration governance essential.

5. Route Selection and Convergence

A router may learn the same destination from several sources. Route selection commonly involves the following principles, although exact values and terminology vary by vendor:

1. The most specific prefix is preferred.
2. If multiple routes have the same prefix, the route with the best administrative preference is considered.
3. Within the same protocol, the route with the best metric is preferred.
4. If routes remain equal, the device may install multiple equal-cost routes and use equal-cost multipath (ECMP).

Administrative distance is a local mechanism; it is not transmitted between routers. It expresses how much a device trusts a source of routing information. Metrics, by contrast, are normally meaningful within a particular routing protocol and cannot be compared directly across different protocols.

Convergence is the process by which routers detect a topology change, recalculate routes and return to a consistent forwarding state. Faster convergence can improve availability, but aggressive timers may increase CPU use or cause instability when links flap. Good design balances detection speed with stability.

Worked routing example

Suppose a router knows three routes to destination 172.16.8.0/24:

• OSPF metric 20, administrative distance 110.
• Static route, administrative distance 200.
• RIP metric 2, administrative distance 120.

The OSPF route is selected because its administrative distance is lower than those of the static and RIP routes. The RIP metric of 2 does not defeat OSPF's metric of 20 because metrics are compared only among routes from the same routing protocol. If two OSPF routes both have metric 20, the router may use ECMP, subject to platform and configuration support.

6. Major Routing Protocol Concepts

OSPF

OSPF is an interior gateway protocol (IGP) designed for routing within one autonomous system. Its cost is commonly derived from interface bandwidth using a configured reference bandwidth. Because implementations and default reference values can differ, administrators should configure and document reference bandwidth consistently rather than assuming that default costs accurately represent modern high-speed links.

OSPF supports areas, route summarisation, authentication options and multiple interface network types. Design considerations include stable area boundaries, appropriate summarisation, control of adjacencies and prevention of accidental redistribution loops.

EIGRP

Enhanced Interior Gateway Routing Protocol (EIGRP) uses a composite metric and the Diffusing Update Algorithm (DUAL). It maintains neighbour, topology and routing information and can identify feasible backup paths. EIGRP has historically been associated with specific vendor environments, although an open specification exists. Its use should therefore be evaluated against interoperability and organisational standards.

BGP

BGP establishes sessions, commonly over TCP port 179, and exchanges network-layer reachability information. External BGP connects different autonomous systems; internal BGP distributes BGP information within one autonomous system. BGP route policy should include explicit prefix filters, maximum-prefix limits, authentication where supported, route validation and monitoring.

Route redistribution

Redistribution imports routes from one routing protocol or source into another. It is sometimes necessary, but it can create feedback loops, inconsistent metrics and excessive route tables. When redistribution is unavoidable, use route tags, filtering, summarisation and a documented policy boundary.

7. WAN Concepts and Connectivity Models

A WAN connects geographically separated locations. It may be operated by an organisation, a telecommunications provider, a cloud provider or a combination of these. WAN design should be based on business requirements rather than technology popularity.

Important requirements include:

• Bandwidth: the rate at which data can be transmitted, commonly measured in bits per second.
• Latency: the time required for traffic to travel between endpoints.
• Jitter: variation in packet delay, important for voice and video.
• Packet loss: packets that fail to reach the destination.
• Availability: the proportion of time a service is operational.
• Symmetry: whether upload and download capacities are similar.
• Service-level agreement (SLA): contractual performance commitments.
• Diversity: use of physically or logically independent paths.

A useful availability relationship for independent components in series is:

where A_system is system availability and A_i is the availability of component i, each expressed as a decimal between 0 and 1. The independence assumption is important; two circuits sharing the same cable or power system are not truly independent. For redundant components operating in parallel, a simplified availability expression is:

This applies when the service remains available if either component works and failures are independent.

Leased lines

A leased line is a dedicated point-to-point circuit supplied by a carrier. It normally offers predictable bandwidth, symmetrical service and strong SLA characteristics. It is suitable for critical branch connectivity, data-centre interconnection and voice or real-time applications.

Its disadvantages are higher cost, installation lead time and limited availability in some locations. A leased line is not automatically encrypted; sensitive traffic may still require encryption.

Broadband

Broadband includes cable, fibre-to-the-premises, digital subscriber line and fixed wireless services. It is often cost-effective and widely available. Fibre generally provides superior capacity and stability, while cable and some wireless services may experience shared-medium contention. Consumer-grade broadband may have dynamic addressing, asymmetric speeds, limited repair commitments or traffic restrictions.

Internet connectivity

Direct Internet access provides reachability to public services and cloud platforms. It is flexible and comparatively inexpensive, but it exposes the organisation to Internet routing variability, attacks and service-provider dependency. Firewalls, secure DNS, monitoring, access control and appropriate redundancy are essential.

VPNs

A virtual private network creates a logical protected connection across an untrusted or shared network. Site-to-site IPsec VPNs commonly provide encrypted connectivity between offices, data centres or cloud gateways. Remote-access VPNs connect individual users to organisational resources.

VPN security depends on cryptographic configuration, authentication, key management, endpoint security and correct routing. Encryption can increase CPU use and reduce effective throughput. A VPN should not be treated as a complete security architecture; least privilege, segmentation and monitoring remain necessary.

MPLS

Multiprotocol Label Switching (MPLS) uses provider-managed labels and can support predictable forwarding, traffic engineering and differentiated service classes. It traditionally offered strong enterprise SLAs and private connectivity. However, MPLS may be expensive and does not inherently encrypt payloads. Many organisations now use hybrid designs combining MPLS with broadband and Internet VPNs.

SD-WAN

Software-defined WAN separates central policy and orchestration from forwarding functions at branch edges. An SD-WAN platform can use multiple underlay services, such as broadband, LTE/5G and MPLS, and select paths according to application policy and measured performance.

Typical capabilities include:

• Centralised configuration and policy management.
• Dynamic path selection based on latency, loss or jitter.
• Application-aware routing.
• Encrypted tunnels between sites.
• Local Internet breakout.
• Simplified deployment through zero-touch provisioning.

SD-WAN does not eliminate the need for sound network engineering. Its control platform becomes a critical dependency, vendor interoperability may be limited, and security responsibilities must be clearly divided between SD-WAN functions, firewalls, cloud security services and endpoint controls.

8. Comparing Connectivity Options

No option is universally best. A hospital may prioritise availability and predictable latency; a small retailer may prioritise cost and rapid deployment; a multinational may require multiple carriers, cloud connectivity and central policy control.

9. Applied Case: Regional Retail Organisation

Background

This illustrative case concerns a retailer with 60 stores, a central warehouse and cloud-based point-of-sale and inventory applications. Each store previously used a single broadband connection and an always-on VPN to headquarters.

Problem

Stores experienced transaction delays during evening congestion. When broadband failed, staff used manual processes. The organisation also found that Internet traffic travelled unnecessarily through headquarters, increasing latency and firewall load.

Analysis

The business identified four requirements: point-of-sale traffic required high availability; inventory traffic required reliable cloud access; guest Wi-Fi had to be isolated; and the solution had to remain affordable for small stores. A single expensive leased line at every store was financially unsuitable. A single broadband circuit was operationally inadequate.

Approach and solution

The organisation deployed two diverse underlay links at larger stores: fibre broadband as the primary service and 5G or a second carrier as backup. Smaller stores used broadband plus 5G. SD-WAN edge devices established encrypted tunnels and measured loss, latency and jitter. Point-of-sale traffic used the best available path, while guest Internet traffic used local breakout and was isolated by firewall policy. Headquarters retained a separate high-capacity circuit for management and central services.

The design also included central logging, configuration backups, alerting, role-based administration and documented failover testing. Routing advertisements were summarised where practical, and default-route behaviour was explicitly controlled to prevent unintended traffic paths.

Outcome

The retailer reduced dependence on a single circuit, improved cloud application responsiveness and shortened fault recovery. It still retained provider and platform dependencies, so quarterly failover tests and supplier reviews remained necessary.

Learning points

1. Resilience requires path diversity, not merely two services from the same physical provider.
2. Encryption and segmentation address different risks.
3. Local Internet breakout can improve performance but increases the importance of branch security controls.
4. SD-WAN simplifies policy enforcement but does not replace capacity planning, monitoring or governance.

10. Security, Governance and Operational Practice

Routing and WAN systems have significant security implications. Incorrect route advertisements can redirect traffic, bypass inspection or isolate services. Administrators should apply the following practices:

• Use management-plane authentication, authorisation and secure protocols.
• Restrict routing adjacencies to trusted interfaces.
• Apply prefix filters and maximum-prefix limits.
• Authenticate routing sessions where supported.
• Maintain configuration version control and approval procedures.
• Monitor route changes, tunnel status, latency, loss and utilisation.
• Separate user, guest, management and critical-service traffic.
• Encrypt sensitive traffic over shared or provider networks.
• Test failover under controlled conditions.
• Document ownership, escalation paths and recovery procedures.

Availability claims should be interpreted carefully. A 99.9% annual availability target permits approximately 8.76 hours of unavailability in a 365-day year, calculated as (1 − 0.999) × 365 × 24 hours. The calculation assumes a full year and treats all downtime equally; contractual definitions may exclude planned maintenance or force majeure events.

Regulatory requirements may affect logging, data residency, lawful interception, retention and encryption. Organisations should involve legal, risk and compliance teams when WAN services carry personal, financial, health or other regulated information.

11. Contemporary Developments

Cloud adoption is changing WAN architecture. Users increasingly access software-as-a-service platforms directly rather than through a central data centre. Secure access service edge (SASE) combines networking and security functions delivered from distributed cloud points of presence. Zero-trust principles require continuous verification of users, devices and application requests rather than assuming that traffic inside a WAN is trustworthy.

Automation and artificial intelligence can assist with anomaly detection, capacity forecasting, configuration validation and incident correlation. However, automated recommendations must be explainable, tested and subject to human approval for high-impact changes. Poor training data, false positives and unsafe automated remediation can create outages. AI should support, not replace, change control and engineering judgement.

Challenges and Limitations

Routing protocols can converge slowly, create transient loops or consume significant control-plane resources. WAN services may have hidden shared infrastructure, uncertain repair times or asymmetric performance. Encryption protects confidentiality but does not guarantee endpoint security or availability. SD-WAN and cloud-managed networking can reduce operational effort while increasing dependence on proprietary controllers and licensing models. Finally, performance measured at a router interface may not represent the experience of an end user or application.

A mature design therefore combines technical measurements with application requirements, supplier assurance, security controls, financial analysis and tested operational procedures.

Chapter Summary

Routing enables communication between IP networks by selecting next hops from routing tables. Routers apply longest-prefix matching and then use administrative preference and protocol metrics to choose among routes. Static routes are predictable and efficient for small or stable environments, while dynamic protocols adapt to topology changes. Distance-vector, link-state and path-vector protocols differ in the information they exchange, the algorithms they use and the environments in which they are effective.

WAN connectivity can be delivered through leased lines, broadband, MPLS, VPNs, mobile services and SD-WAN. Selection should consider bandwidth, latency, jitter, loss, availability, security, cost, diversity and operational capability. SD-WAN can combine several underlay networks and apply application-aware policy, but it does not remove the need for security, monitoring and governance. Reliable network design depends on explicit requirements, route control, encryption where appropriate, resilient paths and regular testing.

Key Terms

Routing: The process of selecting paths for packets between networks.

Router: A Layer 3 device that forwards packets between IP networks.

Routing table: A set of destination prefixes and forwarding information.

Next hop: The immediate neighbouring device to which a packet is sent.

Longest-prefix matching: Selecting the route with the most specific matching prefix.

Default route: A route used when no more specific route exists.

Static route: A manually configured route.

Dynamic routing: Automatic exchange and calculation of reachability information.

Metric: A protocol-specific value used to compare routes.

Administrative distance: A local preference for the source of routing information.

Convergence: The process of reaching a consistent state after a topology change.

OSPF: A link-state interior gateway routing protocol.

BGP: A path-vector protocol used mainly between autonomous systems.

WAN: A network connecting geographically separated locations.

Leased line: A dedicated carrier-provided point-to-point circuit.

VPN: An encrypted or logically private connection over a shared network.

MPLS: A provider technology that forwards traffic using labels.

SD-WAN: Policy-driven management of multiple WAN underlays.

SLA: A contractual commitment concerning service performance.

ECMP: Forwarding across multiple equal-cost paths.

Review Questions

Short Answer Questions

1. What is the purpose of a routing table?
2. Explain longest-prefix matching.
3. State two advantages and two limitations of static routing.
4. What is the difference between a route metric and administrative distance?
5. Why is a VPN not, by itself, a complete security architecture?

Long Answer Questions

1. Compare distance-vector, link-state and path-vector routing protocols.
2. Explain the stages of packet forwarding through a router.
3. Discuss the benefits and limitations of OSPF and BGP in enterprise networks.
4. Compare leased lines, broadband, MPLS and site-to-site VPNs.
5. Explain how SD-WAN changes the design and operation of a hybrid WAN.

Analytical / Application Questions

1. A router has /16, /24 and /25 routes that all match a destination. Which route should be selected, and why?
2. Design a WAN for a small organisation with three branches, cloud applications and a limited budget. Justify your choice of underlay, VPN, routing and redundancy.
3. An enterprise has two Internet circuits from providers that use the same building entry point. Evaluate whether this provides true path diversity and recommend improvements.

Multiple Choice Questions with Answers

Question 1

Which routing principle selects the route with the greatest number of matching network bits?

A. Equal-cost multipath

B. Longest-prefix matching

C. Route poisoning

D. Split horizon

Correct Answer: B. Longest-prefix matching

Question 2

What is the normal purpose of a default route?

A. To match only directly connected networks

B. To replace all dynamic routes

C. To forward traffic when no more specific route exists

D. To encrypt packets before transmission

Correct Answer: C. To forward traffic when no more specific route exists

Question 3

Which protocol is primarily a path-vector protocol?

A. RIP

B. OSPF

C. BGP

D. ARP

Correct Answer: C. BGP

Question 4

Two routes to the same prefix are learned through different routing sources. Which value commonly expresses the local preference between those sources?

A. TTL

B. Administrative distance

C. MTU

D. Window size

Correct Answer: B. Administrative distance

Question 5

A conventional IPv4 /26 subnet contains how many total addresses?

A. 32

B. 64

C. 128

D. 256

Correct Answer: B. 64

Question 6

Which WAN option normally provides a dedicated point-to-point circuit with predictable bandwidth?

A. Leased line

B. Guest Wi-Fi

C. Public DNS

D. Unmanaged switch

Correct Answer: A. Leased line

Question 7

What is a principal capability of SD-WAN?

A. Replacing IP addressing with MAC addressing

B. Selecting paths according to policy and measured link conditions

C. Guaranteeing that every Internet path is physically private

D. Eliminating the need for firewalls

Correct Answer: B. Selecting paths according to policy and measured link conditions

Question 8

Which statement about MPLS is correct?

A. It inherently encrypts all payloads

B. It is used only inside home networks

C. It can provide provider-managed forwarding and service classes

D. It cannot support enterprise WANs

Correct Answer: C. It can provide provider-managed forwarding and service classes

Question 9

What does convergence describe in dynamic routing?

A. The process of compressing packets

B. The time and process required for routers to reach a consistent state after change

C. The conversion of IPv4 addresses to MAC addresses

D. The encryption of routing updates

Correct Answer: B. The time and process required for routers to reach a consistent state after change

Question 10

A 99.9% availability target over a 365-day year permits approximately how much downtime, ignoring contractual exclusions?

A. 8.76 hours

B. 24 hours

C. 87.6 hours

D. 0.876 hours

Correct Answer: A. 8.76 hours